mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-28 18:06:34 +02:00
90ab756de1
Simplified, and de-duplicated many of the configuration settings. Removed configuration settings that could be deduced from other settings. Added some basic documentation. Removed the (duplicate?) user email domain validation check in proxy. Removed the ClientID middleware check. Added a shared key option to be used as a PSK instead of using the IDPs ClientID and ClientSecret. Removed the CookieSecure setting as we only support secure. Added a letsencrypt script to generate a wildcard certificate. Removed the argument in proxy's constructor that allowed arbitrary fucntions to be passed in as validators. Updated proxy's authenticator client to match the server implementation of just using a PSK. Moved debug-mode logging into the log package. Removed unused approval prompt setting. Fixed a bug where identity provider urls were hardcoded. Removed a bunch of unit tests. There have been so many changes many of these tests don't make sense and will need to be re-thought.
28 lines
1 KiB
Bash
28 lines
1 KiB
Bash
#!/bin/bash
|
|
|
|
# The URL that the identity provider will call back after authenticating the user
|
|
export REDIRECT_URL="https://sso-auth.corp.example.com/oauth2/callback"
|
|
# Allow users with emails from the following domain post-fix (e.g. example.com)
|
|
export ALLOWED_DOMAINS=*
|
|
# Generate 256 bit random keys e.g. `head -c32 /dev/urandom | base64`
|
|
export SHARED_SECRET=9wiTZq4qvmS/plYQyvzGKWPlH/UBy0DMYMA2x/zngrM=
|
|
export COOKIE_SECRET=uPGHo1ujND/k3B9V6yr52Gweq3RRYfFho98jxDG5Br8=
|
|
|
|
# OKTA
|
|
# export IDP_PROVIDER="okta
|
|
# export IDP_CLIENT_ID="REPLACEME"
|
|
# export IDP_CLIENT_SECRET="REPLACEME"
|
|
# export IDP_PROVIDER_URL="https://REPLACEME.oktapreview.com/oauth2/default"
|
|
|
|
## GOOGLE
|
|
export IDP_PROVIDER="google"
|
|
export IDP_PROVIDER_URL="https://accounts.google.com" # optional for google
|
|
export IDP_CLIENT_ID="REPLACE-ME.googleusercontent.com"
|
|
export IDP_CLIENT_SECRET="REPLACEME"
|
|
|
|
|
|
# export SCOPE="openid email" # generally, you want the default OIDC scopes
|
|
|
|
# k/v seperated list of simple routes.
|
|
export ROUTES='http.corp.example.com':'httpbin.org'
|
|
|